Privacy Policy

Last updated: 1st August 2026

1. Introduction

This Privacy Policy explains how Kitepeople Trading LLC, trading as “CityBeach” (“CityBeach,” “we,” “us,” or “our”), collects, uses, discloses, and protects personal information when you visit citybeach.ae (the “Site”), create an account, place an order, contact customer support, or otherwise interact with us. It applies to visitors and customers worldwide, including individuals in the European Economic Area and United Kingdom (“EEA/UK”), the United States, and the United Arab Emirates.

By using the Site, you acknowledge the practices described in this Privacy Policy. If you do not agree with this Policy, please do not use the Site.

2. Who We Are (Data Controller)

• Data controller: Kitepeople Trading LLC
• Trading name: CityBeach
• Registered address: Mohamed bin Haydar Al Harthy, Al Muraqabat, office B60, Dubai, UAE
• Trade licence / registration number: 556723
• Privacy contact email: privacy@citybeach.ae
• Data Protection Officer / EU representative (if appointed): Not applicable — no Data Protection Officer has been appointed.

3. Scope of This Policy

This Policy covers personal information collected through the Site, our checkout and order-management system, customer support channels (email, phone, WhatsApp, live chat), our marketing communications, and our presence on third-party platforms (e.g., Meta/Facebook, Google, Instagram) to the extent those platforms are used to interact with you. It does not cover the practices of third-party sites we link to, or of independent marketplace vendors’ own systems outside CityBeach’s platform (see Section 16).

4. Information We Collect

4.1 Information You Provide to Us

• Account information: name, email address, phone number, password (stored in hashed form).
• Order information: billing and shipping address, items purchased, order value, delivery instructions.
• Payment information: we do not store full card numbers on our servers. Payments are processed by Postpay.io and Paymennt, which collect and process your card details directly under their own PCI-DSS-compliant systems and privacy policies.
• Communications: messages you send us via contact forms, email, live chat, or phone, including any information you choose to include in them.
• Marketing preferences: your opt-in/opt-out status for our newsletter and promotional communications.
• Reviews and content you submit: product reviews, ratings, and any images or comments you post on the Site.

4.2 Information Collected Automatically

• Device and usage data: IP address, browser type and version, device type, operating system, referring/exit pages, pages viewed, and timestamps.
• Cookies and similar technologies: see Section 7 (Cookies) for full detail, including essential cookies, analytics cookies (e.g., Google Analytics), and advertising/retargeting cookies and pixels (e.g., Meta/Facebook Pixel, Google Ads remarketing tag) used to measure and personalise advertising for CityBeach products.
• Approximate location data inferred from your IP address, used for currency display, shipping estimates, and fraud prevention.

4.3 Information from Third Parties

• Payment processors and fraud-prevention providers may share transaction status and risk-scoring information with us.
• Shipping and logistics partners may share delivery status updates.
• If you interact with CityBeach through a third-party platform (e.g., commenting on our Facebook or Instagram page, or using “Log in with Google/Facebook” if offered), that platform may share limited profile information with us in accordance with your settings on that platform.

5. How We Use Your Information

• To create and manage your account, and process, fulfil, and deliver your orders.
• To communicate with you about orders, shipping updates, returns, and customer service requests.
• To send you marketing communications where you have opted in, and to let you unsubscribe at any time.
• To personalise your shopping experience and show you relevant products.
• To operate, protect, and improve the Site, including analytics, testing, and troubleshooting.
• To run advertising campaigns and measure their performance on platforms such as Google and Meta, including retargeting visitors who viewed products but did not purchase.
• To detect, investigate, and prevent fraud, abuse, and security incidents.
• To comply with legal, tax, customs, and accounting obligations applicable to a UAE-based retailer.

6. Legal Basis for Processing (EEA/UK Visitors)

Where the GDPR or UK GDPR applies to you, we rely on the following legal bases for processing your personal information:

• Performance of a contract: to process your orders, manage your account, and provide customer support.
• Legitimate interests: to secure the Site, prevent fraud, run non-intrusive analytics, and improve our services, balanced against your rights and interests.
• Consent: for marketing emails, non-essential cookies, and advertising pixels, which you can withdraw at any time (see Sections 7 and 11).
• Legal obligation: to retain order and tax records as required by UAE and applicable law.

7. Cookies and Similar Technologies

We use cookies and similar technologies (such as pixels and local storage) to operate the Site, remember your preferences, understand how visitors use the Site, and deliver relevant advertising. We categorise cookies as follows:

• Strictly necessary cookies: required for core functions such as the shopping cart, checkout, and account login. These cannot be switched off.
• Analytics cookies: help us understand site usage (e.g., Google Analytics) so we can improve the Site.
• Advertising/retargeting cookies: used by Google and Meta/Facebook to show you CityBeach ads on other sites and to measure ad performance, based on your consent.

We are in the process of implementing a cookie-consent banner that will let you accept or reject non-essential cookies on your first visit, and change your choice at any time. Where required by law (EEA/UK, and increasingly other jurisdictions), non-essential cookies will not be set until you consent.

We honour Global Privacy Control (GPC) browser signals as a valid opt-out request from California and other U.S. visitors where applicable.

8. How We Share Your Information

We do not sell your personal information for money. We share personal information with:

• Payment processors (Postpay.io and Paymennt) to complete transactions.
• Shipping and courier partners (Emirates Post, Fedex, Careem, OTTO) to deliver your order.
• IT, hosting, and platform providers (Blue host, WooCommerce/WordPress infrastructure providers) who process data on our behalf under contract.
• Marketing and analytics platforms, including Google (Analytics, Ads) and Meta/Facebook (Pixel, Ads), for site analytics and advertising — this may constitute “sharing” for cross-context behavioural advertising under CPRA (see Section 12).
• Independent marketplace vendors on the Site (see Section 16), limited to the order details needed to fulfil items you purchase from them.
• Professional advisors, regulators, courts, or law enforcement, where required to comply with law, enforce our terms, or protect our rights, safety, or property.
• A buyer or successor in the event of a merger, acquisition, or sale of assets, subject to equivalent privacy protections.

9. International Data Transfers

CityBeach is based in Dubai, United Arab Emirates. Some of our service providers (e.g., Google, Meta, cloud hosting, and payment processors) may process personal information outside the UAE, including in the European Economic Area, United Kingdom, and United States. Where we transfer personal information of EEA/UK individuals outside those regions, we rely on appropriate safeguards such as Standard Contractual Clauses or equivalent mechanisms recognised under GDPR/UK GDPR. Where we transfer personal information of UAE residents internationally, we take steps consistent with the UAE Personal Data Protection Law (Federal Decree-Law No. 45 of 2021) to ensure an adequate level of protection.

10. Data Retention

• Order and transaction records: retained for at least 5 years to meet UAE tax, customs, and accounting obligations.
• Account information: retained for as long as your account is active, and for a reasonable period after closure in case you wish to reactivate it, unless you request earlier deletion.
• Marketing data: retained until you unsubscribe or withdraw consent, after which we suppress your details to honour your opt-out.
• Customer support correspondence: retained for 12 months to handle follow-up queries and disputes.

When personal information is no longer needed for these purposes, we securely delete or anonymise it, except where longer retention is required by law.

11. Your Privacy Rights

11.1 Rights for EEA, UK, and Swiss Residents (GDPR)

If GDPR or UK GDPR applies to you, you have the right to:

• Access the personal information we hold about you.
• Rectify inaccurate or incomplete information.
• Erase your personal information (“right to be forgotten”), subject to legal exceptions.
• Restrict or object to certain processing, including direct marketing and profiling for advertising.
• Data portability, to receive your data in a structured, machine-readable format.
• Withdraw consent at any time, without affecting the lawfulness of processing before withdrawal.
• Lodge a complaint with your local supervisory authority.

11.2 Rights for California and Other U.S. State Residents

If you are a resident of California, Virginia, Colorado, Connecticut, or another U.S. state with a comprehensive privacy law, you have the right, subject to certain exceptions, to:

• Know/access the categories and specific pieces of personal information we have collected about you.
• Delete personal information we have collected from you.
• Correct inaccurate personal information.
• Opt out of the “sale” or “sharing” of your personal information, including sharing for cross-context behavioural advertising (see Section 12).
• Limit the use of sensitive personal information, where applicable.
• Not be discriminated against for exercising any of these rights.
• Designate an authorised agent to submit requests on your behalf.

We will verify your identity before fulfilling access, deletion, or correction requests, using information reasonably necessary to confirm you are the person (or authorised agent) making the request.

11.3 Rights for UAE Residents (PDPL)

Under the UAE Personal Data Protection Law (Federal Decree-Law No. 45 of 2021), you have the right to:

• Request access to, and a copy of, your personal data.
• Request correction or completion of inaccurate or incomplete data.
• Request erasure of your data, subject to legal retention requirements.
• Restrict or object to processing in certain circumstances, including for direct marketing.
• Request data portability, where technically feasible.
• Withdraw consent at any time where processing is based on consent.
• Lodge a complaint with the UAE Data Office.

11.4 How to Exercise Your Rights

You can exercise any of the above rights by emailing privacy@citybeach.ae or by writing to us at Kitepeople Trading LLC, P.O.Box 77763. We will respond within the timeframe required by applicable law (generally within one month under GDPR, and within 45 days under CCPA, extendable where permitted).

12. “Do Not Sell or Share My Personal Information” and Do Not Track

CityBeach does not sell personal information in exchange for money. However, our use of advertising and analytics tools such as the Meta/Facebook Pixel and Google Ads may constitute “sharing” for cross-context behavioural advertising under the CCPA/CPRA. California and other applicable U.S. state residents can opt out at any time by enabling a Global Privacy Control signal in a supported browser, which we will honour. A dedicated opt-out mechanism will be added to the Site once implemented.

Our Site does not currently respond to browser “Do Not Track” signals other than GPC, as there is no common industry standard for interpreting them.

13. Children’s Privacy

The Site is not directed to children, and we do not knowingly collect personal information from anyone under 18 years of age (or the applicable age of digital consent in your jurisdiction, e.g., 16 under GDPR unless a member state sets it lower, or 13 under U.S. COPPA-related rules for a lower bound). If we become aware that we have inadvertently collected personal information from a child, we will delete it promptly. If you believe a child has provided us with personal information, please contact us at privacy@citybeach.ae.

14. Data Security

We use reasonable technical and organisational measures to protect personal information, including encrypted (HTTPS/TLS) connections, restricted access to customer data, and PCI-DSS-compliant payment processing handled by our payment gateway. No method of transmission or storage is completely secure, and we cannot guarantee absolute security. If we become aware of a data breach affecting your personal information, we will notify you and the relevant regulator as required by applicable law.

15. Third-Party Links and Services

The Site may contain links to third-party websites, social media platforms, or services we do not control, such as Instagram, Facebook, or brand partner sites. This Policy does not apply to those third parties, and we encourage you to review their privacy policies separately.

16. Marketplace Vendors

Some products on the Site may be sold by independent third-party vendors operating through our marketplace platform rather than by CityBeach directly. Where you purchase from such a vendor, we share the order information necessary to fulfil that order (such as your name, shipping address, and order details) with the relevant vendor. Vendors are contractually required to use this information only to fulfil your order and in accordance with applicable data protection law, but they act as independent data controllers for their own records.

17. Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our practices or legal requirements. We will post the updated version on this page with a revised “Last updated” date, and where changes are material, we will provide additional notice (e.g., a Site banner or email) before the changes take effect.

18. Contact Us

If you have questions, concerns, or requests regarding this Privacy Policy or your personal information, please contact us:

• Email: privacy@citybeach.ae
• Address: Mohamed bin Haydar Al Harthy, Al Muraqabat, office B60, Dubai, UAE
• Phone: 00971585549098

Appendix A: Categories of Personal Information (U.S. State Law Disclosure)

The table below satisfies the CCPA/CPRA-style requirement to disclose, by category, what personal information we collect, whether we disclose it for a business purpose, and whether it is “sold” or “shared” as those terms are defined under California law. We do not sell personal information for money; where the table says “shared,” it refers to the CPRA definition of sharing for cross-context behavioural advertising via tools such as the Meta Pixel and Google Ads, which you can opt out of at any time (see Section 12).